Function apps should use the latest TLS version
Periodically, newer versions are released for TLS either due to security flaws, include additional functionality, and enhance speed. Upgrade to the latest TLS version for Function apps to take advantage of security fixes, if any, and/or new functionalities of the latest version.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Function apps should use the latest TLS version" (f9d614c5-c173-4d56-95a7-b4437057d193); PowerPipe control azure_compliance.control.appservice_function_app_latest_tls_version.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_145; KICS query "Function App Not Using Latest TLS Encryption Version" (45fc717a-bd86-415c-bdd8-677901be1aa6).
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to SC-8 (Transmission Confidentiality and Integrity) and SC-8(1) (Cryptographic Protection).
NIST Cybersecurity Framework v2.0: Mapped to GV.OC-03 (Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties...) and PR.DS-02 (The confidentiality, integrity, and availability of data-in-transit are protected.).
FedRAMP Moderate Baseline Rev 4: Mapped to SC-8 (Transmission Confidentiality And Integrity) and SC-8(1) (Cryptographic Or Alternate Physical Protection).
Framework mappings
The clauses this control is mapped to in each framework.
- SC-8(1): Cryptographic Protection
- Transmission Confidentiality And Integrity (SC-8)
NIST Cybersecurity Framework v2.0
- GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity -- including privacy and civil liberties obligations -- are understood and managed.
- PR.DS-02
FedRAMP Moderate Baseline Rev 4
- SC-8 (1): Cryptographic Or Alternate Physical Protection
- SC-8(1) Cryptographic Or Alternate Physical Protection
- 3.13.8: Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
- 3.1.h Public Key Infrastructure (PKI)
- SC.L2-3.13.8 Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards
- SC-8 Transmission Confidentiality And Integrity
- SC-8(1) Cryptographic Or Alternate Physical Protection
- 0809.01n2Organizational.1234-01.n 01.04 Network Access Control
- 0810.01n2Organizational.5-01.n 01.04 Network Access Control
- 0811.01n2Organizational.6-01.n 01.04 Network Access Control
- 0812.01n2Organizational.8-01.n 01.04 Network Access Control
- 0814.01n1Organizational.12-01.n 01.04 Network Access Control
1 more clause
- 0949.09y2Organizational.5-09.y 09.09 Electronic Commerce Services
Related controls
- App Service web apps should use the latest TLS version
- Function apps should use the latest 'Python version' when Python is part of the app
- Function apps should not allow CORS access from every resource
- App Service web app slots should require HTTPS for all access
- App Service API apps should require FTPS only
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_function_app_latest_tls_version - Checkov Check:
CKV_AZURE_145 - Powerpipe Control:
azure_compliance.control.appservice_function_app_latest_tls_version - Azure Policy Definition:
f9d614c5-c173-4d56-95a7-b4437057d193 - KICS Query:
45fc717a-bd86-415c-bdd8-677901be1aa6
Last reviewed: 2026-10-11